Description
The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.
Remediation
References
Related Vulnerabilities
WordPress Plugin Activity Log Information Disclosure (2.2.12)
WordPress Plugin Post to Twitter Cross-Site Request Forgery (0.7)
Nginx CVE-2023-27729 Vulnerability (CVE-2023-27729)
Microsoft SQL Server Other Vulnerability (CVE-2000-0603)
Apache HTTP Server Incorrect Calculation of Buffer Size Vulnerability (CVE-2004-0747)